CVE Vulnerability

CVE-2021-41142

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://tuleap.net/plugins/tracker/?aid=22570 Vendor Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d6c837ed6fa66d319175954a42f93d4d86745208 Patch Vendor Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-p3j6-6h9h-34r5 Patch Third Party Advisory
https://github.com/Enalean/tuleap/commit/d6c837ed6fa66d319175954a42f93d4d86745208 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*
cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
Information

Published : 2021-10-14 04:15

Updated : 2021-10-20 06:07

NVD link : CVE-2021-41142

Mitre link : CVE-2021-41142

Products Affected
No products.
CWE
CWE-79